View source for I5:OpenID Relying Party Features

{{DT Article|index=}}
__NOTOC__

==Feature-OpenID Relying Party support for OpenID 1.1==
{{Feature
  |feature_id          = OpenID Relying Party support for OpenID 1.1
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = Supports use of an OpenID with the OpenID 1.1 protocol
  |test_description    = Use an OpenID from an OP only supporting the OpenID 1.1 protocol at the OpenID RP
  |acceptable          = Works
  |not_acceptable      = Failure or Exception
  |testlist            = [[I5:FeatureTest-OpenID RP Accepts OpenIDs from OpenID 1.1 OPs]]
  |maturity_status     = Established
  |maturity_date       = I2
}}

==Feature-OpenID Relying Party support for OpenID 2.0==
{{Feature
  |feature_id          = OpenID Relying Party support for OpenID 2.0
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = Supports use of an OpenID with the OpenID 2.0 protocol
  |test_description    = Use an OpenID from an OP supporting the OpenID 2.0 protocol at the OpenID RP
  |acceptable          = Works
  |not_acceptable      = Failure or Exception
  |testlist            = [[I5:FeatureTest-OpenID RP Accepts OpenIDs from OpenID 2.0 OPs]]
  |maturity_status     = Established
  |maturity_date       = I2
}}

==Feature-OpenID Relying Party support for Simple Registration==
{{Feature
  |feature_id          = OpenID Relying Party support for Simple Registration
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = Supports requesting and receiving Simple Registration attributes
  |test_description    = Request Simple Registration attributes and display the values returned
  |acceptable          = Works when OP supports Simple Registration and works acceptably when it doesn't
  |not_acceptable      = Failure or Exception, particularly when OP doesn't support Simple Registration
  |testlist            = [[I5:FeatureTest-OpenID RP support for Simple Registration]]
  |maturity_status     = Emerging 
  |maturity_date       = I5
}}

==Feature-OpenID Relying Party support for account creation via Simple Registration==
{{Feature
  |feature_id          = OpenID Relying Party support for account creation via Simple Registration
  |feature_type        = usability
  |solution_role       = OpenID Relying Party
  |feature_description = Supports using Simple Registration to create an account associated with an OpenID
  |test_description    = Use a new OpenID at the RP
  |acceptable          = Simple Registration used to retrieve necessary account profile parameters
  |not_acceptable      = Form entry of data required that could have been obtained via Simple Registration
  |testlist            = [[I5:FeatureTest-OpenID Relying Party support for account creation via Simple Registration]]
  |maturity_status     = Established
  |maturity_date       = I2
}}

==Feature-OpenID Relying Party support for Attribute Exchange==
{{Feature
  |feature_id          = OpenID Relying Party support for Attribute Exchange
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = Supports requesting and receiving Attribute Exchange attributes
  |test_description    = Request Attribute Exchange attributes and display the values returned
  |acceptable          = Works when OP supports Attribute Exchange and works acceptably when it doesn't
  |not_acceptable      = Failure or Exception, particularly when OP doesn't support Attribute Exchange
  |testlist            = 
  |maturity_status     = Established
  |maturity_date       = I2
}}

==Feature-OpenID Relying Party support for PAPE==
{{Feature
  |feature_id          = OpenID Relying Party support for PAPE
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = Supports requesting authentication properties via PAPE
  |test_description    = Verify that requested PAPE request parameters are transmitted and reply parameters are returned to the application
  |acceptable          = Allows application to specify PAPE parameters and returns PAPE results to the application
  |not_acceptable      = Taking control from the application by deciding which parameters to use for it and/or how to treat response parameters
  |testlist            = 
  |maturity_status     = Established
  |maturity_date       = I2
}}

==Feature-Can request Phishing-Resistant Authentication==
{{Feature
  |feature_id          = Can request Phishing-Resistant Authentication
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = Can request Phishing-Resistant Authentication
  |test_description    = Verify that Phishing-Resistant request parameter is transmitted when requested and that reply parameters are returned to the application
  |acceptable          = Sends request correctly to OP and returns results to the application
  |not_acceptable      = Request not sent correctly and/or responses not returned to application
  |testlist            = 
  |maturity_status     = Established
  |maturity_date       = I2
}}

==Feature-Can request Multi-Factor Authentication==
{{Feature
  |feature_id          = Can request Multi-Factor Authentication
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = Can request Multi-Factor Authentication
  |test_description    = Verify that Multi-Factor request parameter is transmitted when requested and that reply parameters are returned to the application
  |acceptable          = Sends request correctly to OP and returns results to the application
  |not_acceptable      = Request not sent correctly and/or responses not returned to application
  |testlist            = 
  |maturity_status     = Established
  |maturity_date       = I2
}}

==Feature-Can request Multi-Factor-Physical Authentication==
{{Feature
  |feature_id          = Can request Multi-Factor-Physical Authentication
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = Can request Multi-Factor-Physical Authentication
  |test_description    = Verify that Multi-Factor-Physical request parameter is transmitted when requested and that reply parameters are returned to the application
  |acceptable          = Sends request correctly to OP and returns results to the application
  |not_acceptable      = Request not sent correctly and/or responses not returned to application
  |testlist            = 
  |maturity_status     = Established
  |maturity_date       = I2
}}

==Feature-Accepts OpenID InfoCards==
{{Feature
  |feature_id          = Accepts OpenID InfoCards
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = As per https://openidcards.sxip.com/spec/openid-infocards.html
  |test_description    = Request an OpenID Information Card from the OpenID RP
  |acceptable          = OpenID InfoCards accepted and work
  |not_acceptable      = Failure or Exception
  |testlist            = 
  |maturity_status     = Established
  |maturity_date       = I2
}}

==Feature-Accepts HTTPS:-based OpenIDs==
{{Feature
  |feature_id          = Accepts HTTPS:-based OpenIDs
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = Supports use of a SSL URL as an OpenID
  |test_description    = Use an https: URL from an OP supporting the OpenID 2.0 protocol at the OpenID RP
  |acceptable          = Works
  |not_acceptable      = Failure or Exception
  |testlist            = [[I5:FeatureTest-OpenID RP Accepts HTTPS-based OpenIDs]]
  |maturity_status     = Established
  |maturity_date       = I4
}}

==Feature-Accepts i-name-based OpenIDs==
{{Feature
  |feature_id          = Accepts i-name-based OpenIDs
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = Supports use of an i-name as an OpenID
  |test_description    = Use an i-name from an OP supporting the OpenID 2.0 protocol at the OpenID RP
  |acceptable          = Works
  |not_acceptable      = Failure or Exception
  |testlist            = [[I5:FeatureTest-OpenID RP Accepts i-name-based OpenIDs]]
  |maturity_status     = Established
  |maturity_date       = I2
}}

==Feature-OpenID RP Accepts i-name-based OpenIDs with Unicode characters==
{{Feature
  |feature_id          = OpenID RP Accepts i-name-based OpenIDs with Unicode characters
  |feature_type        = interop
  |solution_role       = OpenID Relying Party
  |feature_description = Supports use of an i-name with Unicode characters as an OpenID (sec 7.2, XRI syntax sec 2.3.1, sec 2.5.5, XRI resolution sec 11.4)
  |test_description    = Use an i-name containing Unicode characters from an OP at the OpenID RP
  |acceptable          = Works
  |not_acceptable      = Failure or Exception
  |testlist            = [[I5:FeatureTest-OpenID RP Accepts i-name-based OpenIDs with Unicode characters]]
  |maturity_status     = Established
  |maturity_date       = I2
}}

==Feature-Display i-name that was verified rather than resulting i-number==
{{Feature
  |feature_id          = Display i-name that was verified rather than resulting i-number
  |feature_type        = usability
  |solution_role       = OpenID Relying Party
  |feature_description = When an i-name OpenID is used, display the i-name that was verified to the user, rather than the i-number associated with the i-name
  |test_description    = Use an i-name as an OpenID at the OpenID RP
  |acceptable          = Display message such as "verified =Mike.Jones as your identity"
  |not_acceptable      = Display message such as "verified xri://=!4138.AF19.8976.CD2A as your identity"
  |testlist            = [[I5:FeatureTest-OpenID RP Display i-name that was verified rather than resulting i-number]]
  |maturity_status     = Established
  |maturity_date       = I2
}}


== Feature-OpenID Relying Party support for Identifier Select ==
{{Feature
  |feature_id           = OpenID Relying Party support for Identifier Select
  |feature_description     =  Supports OpenID 2.0 "Identifier Select"  (sec 14.1.1, and  7.3.2.1.1) 
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Use an OpenID from an OP with a XRDS  http://specs.openid.net/auth/2.0/server Service Endpoint 
  |acceptable         = The user is redirected to the OP with a dialog to select the identifier they want to use for the RP.
  |not_acceptable     = Error or Exception
  |testlist           = [[I5:FeatureTest-OpenID Relying Party support for Identifier Select]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID 2.0 Relying Party support for openID 1.1 delegations via rel links ==
{{Feature
  |feature_id           = OpenID 2.0 Relying Party openID 1.1 delegations via rel links   
  |feature_description     =  Accepts OpenID 1.1 delegations  in discovered rel links  (sec 11.2.1)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Use a OpenID 1.0 URL that has a openid.delegate rel link
  |acceptable         = The RP sends normalized input identifier as the claimed_id and the discovered value of openid.delegate as the openid.identity.
  |not_acceptable     = The RP sends normalized input identifier as the openid.identity,  or something other than the product of the second normalization as the openid.claimed_id
  |testlist           = [[I5:FeatureTest-OpenID 2.0 Relying Party openID 1.1 delegations via rel links]]
  |maturity_status    = Established
  |maturity_date      = I4
}}

== Feature-OpenID 2.0 Relying Party Accepts Namespaced openID 1.1 delegations in XRDS documents ==
{{Feature
  |feature_id           = OpenID Relying Party Accepts Namespaced openID 1.1 delegations in XRDS documents   
  |feature_description     =  Accepts OpenID 1.1 delegations  in a XRDS document if namespacing is used in the XML Element (Yadis and XRI specs)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Use an OpenID that has a openID  delegation in the XRDS in the form of <openid:Delegate xmlns:openid="http://openid.net/xmlns/1.0"> http://ve7jtb.myvidoop.com</openid:Delegate> 
  |acceptable         = The user can log in to the RP using the delegated identity.
  |not_acceptable     = The user cannot log in to the RP using the delegated identity.
  |testlist           = [[I5:FeatureTest-OpenID Relying Party Accepts Namespaced openID 1.1 delegations in XRDS documents]]
  |maturity_status    = Established
  |maturity_date      = I4
}}

== Feature-OpenID 2.0 Relying Party support for openID 2.0 delegations via rel links ==
{{Feature
  |feature_id           = OpenID 2.0 Relying Party openID 2.0 delegations via rel links   
  |feature_description     =  Accepts OpenID 2.0 delegations  in discovered rel links (sec 7.3.3)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Use a OpenID 2.0 URL that has a openid2.local_id rel link
  |acceptable         = The RP sends normalized input identifier as the claimed_id and the discovered value of openid.delegate as the openid.identity.
  |not_acceptable     = The RP sends normalized input identifier as the openid.identity,  or something other than the product of the second normalization as the openid.claimed_id
  |testlist           = [[I5:FeatureTest-OpenID 2.0 Relying Party openID 2.0 delegations via rel links]]
  |maturity_status    = Established
  |maturity_date      = I4
}}

== Feature-OpenID 2.0 Relying Party support for OpenID 2.0 delegation via XRDS ==
{{Feature
  |feature_id           = OpenID 2.0 Relying Party support for OpenID 2.0 delegation via XRDS
  |feature_description     =  Supports OpenID 2.0 Delegated OpenIDs via XRDS
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Use an OpenID with a XRDS  http://specs.openid.net/auth/2.0/signon Service Endpoint containing a <xrd:LocalID> element
  |acceptable         = RP redirects to the OP with the <xrd:LocalID> element as the openid.identity, and the normalized input openID as the openid.claimed_id
  |not_acceptable     = Failure or Exception
  |testlist           = [[I5:FeatureTest-OpenID 2.0 Relying Party support for OpenID 2.0 delegation via XRDS]]
  |maturity_status    = Established
  |maturity_date      = I4
}}

== Feature-OpenID Relying Party uses Claimed_ID as it's primary Key ==
{{Feature
  |feature_id           = OpenID Relying Party uses Claimed_ID as it's primary Key
  |feature_description     =  Supports OpenID 2.0 Claimed_ID as the primary Key 
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Use an OpenID with http:// and https:// URI schemes (no http redirect from http to https)
  |acceptable         = RP treats the two forms as separate identifiers.
  |not_acceptable     = The identifiers are treated as equivalent by the RP
  |testlist           = [[I5:FeatureTest-OpenID Relying Party uses Claimed ID as its Primary Key]]
  |maturity_status    = Established
  |maturity_date      = I4
}}

== Feature-OpenID Relying Party has HMAC-SHA256 support  ==
{{Feature
  |feature_id           = OpenID Relying Party has HMAC-SHA256 support 
  |feature_description     =  Supports OpenID 2.0 HMAC-SHA256 (Sec 8.4.2)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Use an OpenID from an OP with support for HMAC-SHA1 disabled.
  |acceptable         = The user can log in to the RP.
  |not_acceptable     = The user cannot log in to the RP
  |testlist           = [[I5:FeatureTest-OpenID Relying Party has HMAC-SHA256 support]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID Relying Party Accepts unsolicited positive assertions  ==
{{Feature
  |feature_id           = OpenID Relying Party Accepts unsolicited positive assertions
  |feature_description     =  Accepts OpenID 2.0 unsolicited positive assertions (Sec 10 and 11.2)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Use an OpenID from an OP that supports bookmarks using unsolicited positive assertions.  Create a bookmark for the RP.
  |acceptable         = The user can log in to the RP directly from the OP bookmark without redirection.
  |not_acceptable     = The user cannot log in to the RP directly from the OP bookmark without redirection.
  |testlist           = [[I5:FeatureTest-OpenID Relying Party Accepts unsolicited positive assertions]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID Relying Party Publishes a XRDS document for its realm specifying the return to URL ==
{{Feature
  |feature_id           = OpenID Relying Party Publishes a XRDS document for its realm specifying the return to URL   
  |feature_description     =  A XRDS document is published by the RP specifying the return to URL.  (sec 13)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform (Yadis/XRI resolution Sec 6) on the RPs realm
  |acceptable         = A XRDS document containing a SEP of type http://specs.openid.net/auth/2.0/return_to is returned.
  |not_acceptable     = An XRDS with the appropriate SEP is not found.
  |testlist           = [[I5:FeatureTest-OpenID Relying Party Publishes a XRDS document for its realm specifying the return to URL]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID Relying Party validates the openid.return_to in the response ==
{{Feature
  |feature_id           = OpenID Relying Party validates the openid.return_to in the response   
  |feature_description     =  The openID Relying Party validates the openid.return_to in the response against the URL processing the assertion (sec 11.1)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a openID login from an OP that modifies the openid.return_to value 
  |acceptable         = The positive assertion is rejected by the RP
  |not_acceptable     = The RP accepts the positive assertion.
  |testlist           =  [[I5:FeatureTest-OpenID Relying Party validates the openid.return to in the response]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID Relying Party validates positive assertions against Discovered  Information ==
{{Feature
  |feature_id           = OpenID Relying Party validates positive assertions against Discovered  Information   
  |feature_description     =  The openID Relying Party validates the openid.identity, openid.claimed_id, openid.op_endpoint and  openid.ns against the discovered information (sec 11.2)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a openID login from an OP that modifies the openid.claimed_id 
  |acceptable         = The RP lets the user in if the new claimed_id verifies against discovered information,  and does not if it does not verify
  |not_acceptable     = The RP does not let the user in if the new claimed_id verifies against discovered information,  or does allow accessif it does not verify
  |testlist           = [[I5:FeatureTest-OpenID Relying Party validates positive assertions against Discovered  Information]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID Relying Party validates an assertion with the same openid.response_nonce has not already been processed ==
{{Feature
  |feature_id           = OpenID Relying Party validates an assertion with the same openid.response_nonce has not already been processed   
  |feature_description     =  The openID Relying Party must validate the openid.response_nonce to make sure that it has not already been accepted from the OP (sec 11.3)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform multiple openID logins from a OP that returns the same openid.response_nonce each time.
  |acceptable         = The RP rejects subsequent logins with the same nonce.
  |not_acceptable     = The RP allows multiple logins with the same nonce.
  |testlist           = [[I5:FeatureTest-OpenID Relying Party validates an assertion with the same openid.response nonce has not already been processed]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID Relying Party validates the 1.1 signature on the assertion is valid and all fields that are required to be signed are signed ==
{{Feature
  |feature_id           = OpenID Relying Party validates the 1.1 signature on the assertion is valid and all fields that are required to be signed are signed
  |feature_description     =  The openID Relying Party must validate the signature on the assertion is valid and all fields that are required to be signed are signed (OpenID sec 11.4)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a openID login from a OP that returns an invalid openID 1.1 signature or elements not properly signed.
  |acceptable         = The RP rejects the logins.
  |not_acceptable     = The RP allows the logins.
  |testlist           = [[I5:FeatureTest-OpenID Relying Party validates the 1.1 signature on the assertion is valid and all fields that are required to be signed are signed ]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID Relying Party validates the 2.0 signature on the assertion is valid and all fields that are required to be signed are signed ==
{{Feature
  |feature_id           = OpenID Relying Party validates the 2.0 signature on the assertion is valid and all fields that are required to be signed are signed
  |feature_description     =  The openID Relying Party must validate the signature on the assertion is valid and all fields that are required to be signed are signed (OpenID sec 11.4)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a openID login from a OP that returns an invalid openID 2.0 signature or elements not properly signed.
  |acceptable         = The RP rejects the logins.
  |not_acceptable     = The RP allows the logins.
  |testlist           = [[I5:FeatureTest-OpenID Relying Party validates the 2.0 signature on the assertion is valid and all fields that are required to be signed are signed ]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID Relying Party protects against association poisoning ==
{{Feature
  |feature_id           = OpenID Relying Party protects against association poisoning 
  |feature_description     =  The openID Relying Party must treat associations as global, an association handel is relitive to the OP Endpoint the association is from
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform 3 openID logins from a OP that attempts to hijack the association
  |acceptable         = The RP rejects the 2nd and 3rd logins.
  |not_acceptable     = The RP allows the logins.
  |testlist           = [[I5:FeatureTest-OpenID Relying Party protects against association poisoning ]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}


== Feature-OpenID Relying Party sends Accept request-header when performing discovery ==
{{Feature
  |feature_id           = OpenID Relying Party sends Accept request-header when performing discovery
  |feature_description     =  The openID Relying Party must send the Accept request-headerapplication/xrds+xml when performing discovery on a URL (OpenID sec 7.3, Yadis 1.0 sec 6.2.4)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a openID 2.0 login from a identifier that returns different OP endpoints via a direct XRDS reply and a X-XRDS-Location header.
  |acceptable         = The RP uses the OP endpoint pointed to in the XRDS retrieved via the accept header.
  |not_acceptable     = The RP uses the OP endpoint pointed to in the XRDS retrieved X-XRDS-Location header.
  |testlist           = [[I5:FeatureTest-OpenID Relying Party sends Accept request-header when performing discovery]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}


== Feature-OpenID Relying Party follows XRDS level refs during resolution of XRI identifiers ==
{{Feature
  |feature_id           = OpenID Relying Party follows XRDS level refs during resolution of XRI identifiers
  |feature_description     =  The openID Relying Party must follow XRD level refs when resolving iNames (XRI 2.0 Resolution Sec 12.4)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a openID 2.0 login from a identifier that contains a XRD level REF to a XRD that contains the openID SEP.
  |acceptable         = The RP uses the CID and SEP of the ref target XRI.
  |not_acceptable     = The RP uses the CID and SEP of the ref source XRI, or fails.
  |testlist           =
  |maturity_status    = Established
  |maturity_date      = I4
}}

== Feature-OpenID Relying Party follows SEP level refs during resolution of XRI identifiers ==
{{Feature
  |feature_id           = OpenID Relying Party follows SEP level refs during resolution of XRI identifiers
  |feature_description     =  The openID Relying Party must follow SEP level refs when resolving iNames (XRI 2.0 Resolution Sec 12.4)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a openID 2.0 login from a identifier that contains a SEP level REF to a XRD that contains a openID SEP not containing a further ref.
  |acceptable         = The RP uses the CID and SEP of the ref target XRI.
  |not_acceptable     = The RP uses the CID and SEP of the ref source XRI, or fails.
  |testlist           =
  |maturity_status    = Established
  |maturity_date      = I4
}}

== Feature-OpenID RP accepts x.509v3 alternate names in certs==
{{Feature
  |feature_id           = OpenID RP accepts x.509v3 alternate names in certs
  |feature_description     =  The X.509v3 Certificate of an Identity Provider may contain one or more subject alternate names the RP should accept the certificate for hosts other than the one in the certificate "Common Name"
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a https: openID 2.0 login to a RP with a openID that utilizes a subject alt name in the cert.
  |acceptable         = The RP should allow the login.
  |not_acceptable     = The RP disallows the login, or error with no actionable message.
  |testlist           = [[I5:FeatureTest-OpenID RP accepts x.509v3 alternate names in certs]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID Relying Party Verify X.509 certificate associated with Identity Provider==
{{Feature
  |feature_id           = OpenID Relying Party Verify X.509 certificate associated with Identity Provider
  |feature_description     =  The X.509 Certificate of an Identity Provider should be validated in the following ways:  the certificate chain should be validated, the certificate should be checked for revocation via CRL as per RFC 3280 or OCSP per RFC 2560, and the host associated with the certificate should match the host presenting the certificate.  This should be done for the claimed_id and the OP endpoint as part of association.
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a https: openID login to a RP with a openID that has a revoked certificate.
  |acceptable         = The RP should fail the login with an actionable message
  |not_acceptable     = The RP allows the login, or error with no actionable message.
  |testlist           = [[I5:FeatureTest-OpenID Relying Party Verify X.509 certificate associated with Identity Provider]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID RP accepts x.509v3 certs issued by CA Cert==
{{Feature
  |feature_id           = OpenID RP accepts x.509v3 certs issued by CA Cert
  |feature_description     =  The X.509v3 Certificate is or is not accepted by the RP.  This is a way for OPs that have certificates issued by CA Cert to know if a RP will accept it. The RP's trust policy determines if this test should pass or fail.  
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a https: openID 2.0 login to a RP with a openID that utilizes a "CA Cert" issued cert.
  |acceptable         = The RP should allow the login.
  |not_acceptable     = The RP disallows the login, or error with no actionable message.
  |testlist           = [[I5:FeatureTest-OpenID RP accepts x.509v3 certs issued by CA Cert]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID RP accepts x.509v3 certs issued by Start SSL Class 1==
{{Feature
  |feature_id           = OpenID RP accepts x.509v3 certs issued by Start SSL Class 1
  |feature_description     =  The X.509v3 Certificate is or is not accepted by the RP.  This is a way for OPs that have certificates issued by "Start SSL" Class 1 CA to know if a RP will accept it. The RP's trust policy determines if this test should pass or fail.  
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a https: openID 2.0 login to a RP with a openID that utilizes a "Start SSL Class 1" issued cert.
  |acceptable         = The RP should allow the login.
  |not_acceptable     = The RP disallows the login, or error with no actionable message.
  |testlist           = [[I5:FeatureTest-OpenID RP accepts x.509v3 certs issued by Start SSL Class 1]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID RP accepts x.509v3 certs issued by Start SSL Class 2==
{{Feature
  |feature_id           = OpenID RP accepts x.509v3 certs issued by Start SSL Class 2
  |feature_description     =  The X.509v3 Certificate is or is not accepted by the RP.  This is a way for OPs that have certificates issued by "Start SSL" Class 2 CA to know if a RP will accept it. The RP's trust policy determines if this test should pass or fail.  
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a https: openID 2.0 login to a RP with a openID that utilizes a "Start SSL Class 2" issued cert.
  |acceptable         = The RP should allow the login.
  |not_acceptable     = The RP disallows the login, or error with no actionable message.
  |testlist           = [[I5:FeatureTest-OpenID RP accepts x.509v3 certs issued by Start SSL Class 2]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID RP rejects certs that are not valid for the domain==
{{Feature
  |feature_id           = OpenID RP rejects certs that are not valid for the domain
  |feature_description     =  The X.509v3 Certificate is checked by the RP to be valid for the DNS name.
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a https: openID 2.0 login to a RP with a openID that is for a different domain than the certificate.
  |acceptable         = The RP should not allow the login.
  |not_acceptable     = The RP allows the login.
  |testlist           = [[I5:FeatureTest-OpenID RP rejects certs that are not valid for the domain]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}

== Feature-OpenID RP rejects certs that are expired==
{{Feature
  |feature_id           = OpenID RP rejects certs that are expired
  |feature_description     =  The X.509v3 Certificate is checked by the RP to see if it has expired.
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a https: openID 2.0 login to a RP with a openID that has an expired certificate.
  |acceptable         = The RP should not allow the login.
  |not_acceptable     = The RP allows the login.
  |testlist           = [[I5:FeatureTest-OpenID RP rejects certs that are expired]]
  |maturity_status    = Emerging
  |maturity_date      = I5
}}


== Feature-OpenID 2.0 Relying Party Requests and Accepts ID-WSF EPR via Attribute Exchange==
{{Feature
  |feature_id           = OpenID 2.0 Relying Party Requests and Accepts ID-WSF EPR token via Attribute  Exchange
  |feature_description     =  The openID Relying Party receives a EPR token via AX (http://iiw.idcommons.net/index.php/OpenID_Bootstrapping_ID-WSF_2.0)
  |interoptype        = 
  |solution_role       = OpenID Relying Party
  |feature_type        = interop
  |test_description    = Preform a openID 2.0 login to a RP that is a ID-WSF Web services client.
  |acceptable         = The RP uses AX to retrieve a EPR token to access a ID-WSF service like the "People Service".  (Yadis discovery of the EPR is optional)
  |not_acceptable     = The RP doesn't request or process the EPR token.
  |testlist           =
  |maturity_status    = Established
  |maturity_date      = I4
}}